Undisclosed organization operating an Azure tenant
June 1, 2026
•[ hack, technology ]
In early June 2026, JadePuffer (Microsoft Storm-3168) used two compromised Azure service principals belonging to one undisclosed tenant. One identity enumerated cloud assets and a second deleted most of more than 100 targeted storage accounts plus a Key Vault, Function App and App Service plan. The operator also retrieved storage account access keys. Attempts to delete Azure SQL databases and recovery-protection locks failed; no ransom note or exfiltration of stored customer/business files was verified.
Hollard Insurance Group
June 1, 2026
•[ ransomware, finance, technology ]
South African insurer Hollard's funeral-policyholder data was leaked by The Gentlemen in Sept. 2026 after a June 2026 extortion breach of its administrator MIP Holdings' Jira platform. Hollard says its own systems were not compromised and notified affected customers.
TVING Corporation
June 2, 2026
•[ leak, technology ]
TVING confirmed unauthorized access to and extraction from its account database on June 2, 2026, after abnormal activity from May 30. September government findings revised the scope to approximately 39.54 million account records, including dormant and test accounts, and reported exposure of some source-code files and encryption keys. The company blocked attacker access and reported the incident to Korean authorities. The attacker has not been publicly identified. This updates the previously coded June incident and is not a second breach.
Australian Centre for the Moving Image
June 2, 2026
•[ leak, hack, technology ]
On June 2, 2026, ACMI identified and contained unauthorized access affecting a third-party system supporting its Cinema 3 online streaming service. The threat actor 2019 published three datasets allegedly containing information from more than 25,000 customers, while ACMI confirmed that names, email addresses, IP addresses, and rental details were exposed but passwords and financial information were not.
Indian Institute of Technology Roorkee
June 2, 2026
•[ leak, misconfiguration, education ]
On June 2, 2026, cybersecurity researcher Rylen Anil discovered that a cloud-storage component supporting IIT Roorkees JEE Advanced results system allowed candidate files to be accessed without authentication. Anil downloaded a small number of files to verify the exposure and reported the issue, after which IIT Roorkee restricted access and said its logs showed no bulk download and access to less than 0.05% of the stored data.
C2M LLC d/b/a Click2Mail
June 2, 2026
•[ financial, leak, technology ]
A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
Norsk Tipping AS
June 2, 2026
•[ ddos, hack, technology ]
A DDoS attack against Norsk Tipping began shortly before 20:30 June 2 and intensified about 21:00, overloading gaming services, especially KongKasino. Telenor mitigated the traffic and the company said traffic normalized about 23:00. No customer-data breach was reported. The operator remains unidentified. Sabotage is inferred from deliberate service interference against a government-owned national gambling operator, not from a proven political or financial demand.
PHOBS d.o.o.
June 3, 2026
•[ hack, phishing, technology ]
On June 3, 2026, unauthorized actors accessed guest reservation data stored in the PHOBS reservation-management platform. PHOBS said approximately 100,000 booking records may have been affected, exposing information that could be used in targeted phishing and fraudulent payment messages, while payment-card data was not compromised.
Norsk Tipping AS
June 3, 2026
•[ ddos, hack, technology ]
On June 3, after the previous evening's DDoS had been contained and service restored, Norsk Tipping experienced another traffic-flooding attack. Customers reported delays and failed access to some online games. The company confirmed restoration around 23:00, with no data compromise. The attacker was not identified. Sabotage is inferred from repeated efforts to obstruct this state-owned public gambling service.
Affected Hola Browser for Windows users
June 4, 2026
•[ malware, technology ]
A localized compromise of Hola's software-distribution pipeline caused an undeclared XMRig cryptocurrency miner to be bundled with some Windows installations of Hola Browser. The miner was installed persistently on affected devices and used their processing resources to generate Monero. Hola estimated that approximately 0.1% of users were affected and reported no evidence that user data was accessed or stolen.
Madison Square Garden Sports Corp.
June 5, 2026
•[ social, hack, technology ]
ShinyHunters stated that it breached Madison Square Garden on 2026-06-05 by vishing a low-level employee and abusing Microsoft Entra password-reset access, after which it reached cloud applications including Salesforce. The group demanded payment and published approximately 45 GB of data on 2026-06-16. It claimed more than 26 million customer and corporate records, while later analysis identified 9,782,361 unique email addresses and 2,820,221 unique telephone numbers. Reviewed files included internal talent and risk-assessment records, customer correspondence, and employee material. Reviewed reporting did not confirm that facial-recognition images or payment data were included.
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
PT Tempo Inti Media Tbk
June 5, 2026
•[ hack, ddos, technology ]
Beginning on 2026-06-05, unidentified attackers used bot-generated traffic in an intermittent DDoS attack against Tempo's news website, making it difficult for the public to access. Tempo recorded 24.9 million malicious requests through 2026-06-08, including 12.97 million during one reported two-hour surge. Tempo suspected the attack was intended to interfere with its journalism and may have followed a separate late-May compromise that temporarily unpublished corruption-related articles, but neither the connection nor the perpetrator was confirmed.
Wiese USA
June 5, 2026
•[ leak, technology ]
Termite claimed Wiese USA on June 8, 2026, with threat-intelligence tracking estimating the underlying attack on June 5. DataBreach.com subsequently indexed 229,721 records containing personal information. Litigation filed after the June incident alleges theft and disclosure of personally identifiable information. No independently verified operational disruption has been established.
Undisclosed organization in Unit 42 Pink-related extortion investigation
June 5, 2026
•[ ransomware, phishing, technology ]
Palo Alto Networks Unit 42 investigated an extortion case involving an unnamed organization. On June 1, 2026, an attacker renewed contact in an existing negotiation, supplied a new qTox identifier and a data-leak site associated with the Pink extortion brand, and referenced essentially the same information claimed taken in an earlier extortion notice. Unit 42 described the broader cluster using voice phishing and cloud-service data theft. The specific initial access, actual exfiltration, victim industry and country, and whether the original intruder was identical to the Pink contact were not established. Event date is a publication-date fallback, not a verified theft date.
Nexstar Media Group, Inc.
June 6, 2026
•[ leak, technology ]
ShinyHunters claimed that it accessed Nexstar Media Group systems on June 6, 2026 and stole more than 1 million Salesforce records and additional internal corporate data. DataBreach.com subsequently indexed 103,128 rows. Nexstar stated that it was investigating reports of a potential IT security incident and that its operations were not disrupted. The company did not publicly confirm the actor's full claimed scope.
French Interministerial Directorate for Digital Affairs (DINUM) – Tchap
June 7, 2026
•[ hack, government, technology ]
On June 7, 2026, an attacker hijacked a Tchap user account and accessed public, unencrypted chat rooms on the French government's messaging platform. DINUM confirmed that 73,467 registered government users were affected and that account information including names, email addresses, affiliated entities, and avatars was potentially exposed. The actor misere additionally claimed theft of 13.5 GB containing more than 643,000 messages and files, but that claim was not independently verified.
Multiple undisclosed macOS users
June 8, 2026
•[ malware, technology, hack ]
Operation FlutterBridge used malicious Google advertisements to distribute signed and notarized macOS applications masquerading as a podcast player or PDF viewers. The FlutterShell payload modified Chrome settings to redirect traffic through attacker-controlled advertising sites and provided command execution, file-system manipulation, and environment-variable collection capabilities. Unit 42 observed multiple infected hosts but did not identify individual victims. Because no specific infection date was reported in the supplied source, the publication date is used as the event date.
One Medical Seniors via an undisclosed third-party file storage provider
June 8, 2026
•[ leak, healthcare, technology ]
An unauthorized third party accessed a third-party file storage system containing archived One Medical Seniors patient information between 2026-06-08 and 2026-06-11. One Medical discovered the access on 2026-06-13, revoked access, rotated credentials, and stated that the incident was limited to the storage platform and did not affect other One Medical clinics, services, or its electronic medical record system. ShinyHunters claimed to have stolen 8.8 TB and threatened publication, but One Medical did not publicly attribute the breach or confirm the claimed volume.
University of Nottingham
June 9, 2026
•[ hack, leak, education ]
On 2026-06-09, the University of Nottingham detected unauthorized access to its Campus Solutions student-records system and took the affected system offline as a containment measure. The university confirmed that a significant amount of student and alumni data had been accessed. ShinyHunters claimed responsibility and published more than 40 GB of data. Have I Been Pwned identified approximately 455,000 unique email addresses in the leak. The university did not publicly attribute the intrusion.
